• 1 Post
  • 11 Comments
Joined 1 month ago
cake
Cake day: March 14th, 2025

help-circle


    • 2 decades: Netherlands
    • 2 years: Belgium
    • 2 months: Finland
    • 2 weeks: Iceland
    • 2 days: United Kingdom
    • 2 hours: Switzerland
    • Somewhere between 2 minutes and 2 seconds: Netherlands, Germany, Belgium all at once

    • 6 years: Germany
    • 6 months: France
    • 6 weeks… this is getting tricky, Luxembourg is probably closest but not close enough to claim this tier
    • 6 days: Poland
    • 6 hours: Sweden
    • 6 minutes: I give up

    I didn’t realise it was a life goal of mine to spend 6 minutes in a country until this post, but now I’m not sure I can unsee this list. Maybe the Vatican is a good candidate for that? Italy can go in the 2 days slot, bumping UK up to 6 weeks another time. Germany will exceed the 6 years slot soon though, maybe I’ll need to visit all sixers to get bingo on a row of sevens instead. And where are we going for 7 seconds? Another tripoint, does that count?



  • Size matters… but only to a certain point! I’ve cracked longer ones from e.g. the LinkedIn password dump for a school project

    The reason this works is because they’re not random characters. People use 111111(etc.) as password (perhaps because it’s funny), repetitions of shorter passwords, a phrase that can be found on Wikipedia or elsewhere (“Maryhadalittlelamb” — for some reason people always remove the spaces, even if they write it down with spaces on paper when putting e.g. the WiFi password on a whiteboard! Drives me mad), words optionally with leet$p3ak (words are about half as random per character as random characters are, and that’s assuming people would pick entirely random words), and other predictable things

    The number of characters is thus rather meaningless for the password strength, besides calculating a lower bound

    I’d say:

    1. Use a randomly generated password. Memorise only a few, like for your disk encryption, password manager, bank login, and probably a few others. It’s a bit more difficult than memorising a mobile phone number but not by much
    2. Make sure it’s random enough, usually measured in bits. More is better, I forgot what we expect a (non-quantum) computer to be able to do exactly in 20 years but it’s on the order of 80 bits, which would be ceil(log(2^(80))/log(26+26+10))=14 characters when you use lowercase letters, uppercase letters, and digits, or ceil(log(2^(80))/log(6667))=7 Diceware words if I remember correctly that the dictionary contains 6667 words. Adjust to the character set or dictionary you use and the desired strength
    3. Use it regularly. You’ll forget ones you’ve not used for several months. Don’t want that to happen to my 2FA token backup, for example. If you don’t naturally use them regularly, set reminders to check it, or store the password in a safe place if possible (offline, and perhaps look into secret sharing schemes for this)

    If you know something will use a strong password hashing function like Bcrypt or Argon2, especially if you can set a good number of rounds/memory to be used, the requirements can be relaxed but I find it easier to have a few definitely-secure passwords than to try to seek out the edge of what’s safe

    When you use a TPM or HSM or whatever a given variant is called (like a smartcard), such that you can only do a limited number of attempts in the first place, a few digits may be enough for your needs (PIN code). Mobile phones and modern computers often have these, but they’re also often broken. Needs physical access though, so it again depends on what kind of threats you think are realistic for your situation

    Do switch to Argon2 in LUKS, but not out of fear please. Know that your password is good based on the maths and then upgrade at leisure :)






  • Ha, grappig om te lezen dat ik niet de enige ben die nog Engels spreekt tegen diens vriendin terwijl ik inmiddels haar taal spreek!

    Vind jij het ook lastig om te switchen met jouw vriendin, zelfs maar als oefening? Wanneer ik met haar mijn Duits wil oefenen (zij is Duits, ik Nederlands) is het een beetje alsof ik probeer een computermuis ondersteboven te gebruiken: veel te makkelijk om terug te switchen naar iets dat ik wel volledig beheers en waarin ik efficiënt gezegd krijg wat ik wil overbrengen — precies de reden waarom ik het zou moeten oefenen dus >.<